Mailu Proxy Authentication proxy.conf X-Forwarded-By improper authentication

Summaryinfo

A vulnerability marked as very critical has been reported in Mailu. This impacts an unknown function of the file core/nginx/conf/proxy.conf of the component Proxy Authentication. Performing a manipulation of the argument X-Forwarded-By results in improper authentication. This vulnerability was named CVE-2026-85751. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Mailu (the affected version is unknown). This affects an unknown code of the file core/nginx/conf/proxy.conf of the component Proxy Authentication. The manipulation of the argument X-Forwarded-By with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-85751 since 09/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Mailu

Website

• Product: https://github.com/Mailu/Mailu/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion